Allow the database password to be unmanaged

Author: natemccurdy

README.md

@@ -403,6 +403,12 @@ The name of the database user to connect as. Defaults to `puppetdb`, ignored for
 The password for the database user. Defaults to `puppetdb`, ignored for
 `embedded` database.
 
+#### `manage_db_password`
+
+Whether or not the database password in database.ini will be managed by this module.
+Set this to `false` if you want to set the password some other way.
+Defaults to `true`
+
 #### `database_name`
 
 The name of the database instance to connect to. Defaults to `puppetdb`, ignored
@@ -561,6 +567,12 @@ option is supported in PuppetDB >= 1.6.
 The password for the read database user. Defaults to `puppetdb`. This option is
 supported in PuppetDB >= 1.6.
 
+#### `manage_read_db_password`
+
+Whether or not the database password in read-database.ini will be managed by this module.
+Set this to `false` if you want to set the password some other way.
+Defaults to `true`
+
 #### `read_database_name`
 
 The name of the read database instance to connect to. Defaults to `puppetdb`.

manifests/init.pp

@@ -30,6 +30,7 @@
   $database_username                 = $puppetdb::params::database_username,
   $database_password                 = $puppetdb::params::database_password,
   $database_name                     = $puppetdb::params::database_name,
+  $manage_db_password                = $puppetdb::params::manage_db_password,
   $jdbc_ssl_properties               = $puppetdb::params::jdbc_ssl_properties,
   $database_listen_address           = $puppetdb::params::postgres_listen_addresses,
   $database_validate                 = $puppetdb::params::database_validate,
@@ -53,6 +54,7 @@
   $read_database_username            = $puppetdb::params::read_database_username,
   $read_database_password            = $puppetdb::params::read_database_password,
   $read_database_name                = $puppetdb::params::read_database_name,
+  $manage_read_db_password           = $puppetdb::params::manage_read_db_password,
   $read_database_jdbc_ssl_properties = $puppetdb::params::read_database_jdbc_ssl_properties,
   $read_database_validate            = $puppetdb::params::read_database_validate,
   $read_log_slow_statements          = $puppetdb::params::read_log_slow_statements,
@@ -105,6 +107,7 @@
     database_username                 => $database_username,
     database_password                 => $database_password,
     database_name                     => $database_name,
+    manage_db_password                => $manage_db_password,
     jdbc_ssl_properties               => $jdbc_ssl_properties,
     database_validate                 => $database_validate,
     database_embedded_path            => $database_embedded_path,
@@ -130,6 +133,7 @@
     read_database_username            => $read_database_username,
     read_database_password            => $read_database_password,
     read_database_name                => $read_database_name,
+    manage_read_db_password           => $manage_read_db_password,
     read_database_jdbc_ssl_properties => $read_database_jdbc_ssl_properties,
     read_database_validate            => $read_database_validate,
     read_log_slow_statements          => $read_log_slow_statements,

manifests/params.pp

@@ -32,6 +32,7 @@
   $database_name          = 'puppetdb'
   $database_username      = 'puppetdb'
   $database_password      = 'puppetdb'
+  $manage_db_password     = true
   $jdbc_ssl_properties    = ''
   $database_validate      = true
   $database_max_pool_size = undef
@@ -57,6 +58,7 @@
   $read_database_name                = 'puppetdb'
   $read_database_username            = 'puppetdb'
   $read_database_password            = 'puppetdb'
+  $manage_read_db_password           = true
   $read_database_jdbc_ssl_properties = ''
   $read_database_validate            = true
   $read_log_slow_statements          = '10'

manifests/server.pp

@@ -25,6 +25,7 @@
   $database_username                      = $puppetdb::params::database_username,
   $database_password                      = $puppetdb::params::database_password,
   $database_name                          = $puppetdb::params::database_name,
+  $manage_db_password                     = $puppetdb::params::manage_db_password,
   $jdbc_ssl_properties                    = $puppetdb::params::jdbc_ssl_properties,
   $database_validate                      = $puppetdb::params::database_validate,
   $database_embedded_path                 = $puppetdb::params::database_embedded_path,
@@ -47,6 +48,7 @@
   $read_database_username                 = $puppetdb::params::read_database_username,
   $read_database_password                 = $puppetdb::params::read_database_password,
   $read_database_name                     = $puppetdb::params::read_database_name,
+  $manage_read_db_password                = $puppetdb::params::manage_read_db_password,
   $read_database_jdbc_ssl_properties      = $puppetdb::params::read_database_jdbc_ssl_properties,
   $read_database_validate                 = $puppetdb::params::read_database_validate,
   $read_log_slow_statements               = $puppetdb::params::read_log_slow_statements,
@@ -161,6 +163,7 @@
     database_username      => $database_username,
     database_password      => $database_password,
     database_name          => $database_name,
+    manage_db_password     => $manage_db_password,
     database_max_pool_size => $database_max_pool_size,
     jdbc_ssl_properties    => $jdbc_ssl_properties,
     database_validate      => $database_validate,
@@ -186,6 +189,7 @@
     database_username      => $read_database_username,
     database_password      => $read_database_password,
     database_name          => $read_database_name,
+    manage_db_password     => $manage_read_db_password,
     jdbc_ssl_properties    => $read_database_jdbc_ssl_properties,
     database_validate      => $read_database_validate,
     log_slow_statements    => $read_log_slow_statements,

manifests/server/database.pp

@@ -6,6 +6,7 @@
   $database_username      = $puppetdb::params::database_username,
   $database_password      = $puppetdb::params::database_password,
   $database_name          = $puppetdb::params::database_name,
+  $manage_db_password     = $puppetdb::params::manage_db_password,
   $jdbc_ssl_properties    = $puppetdb::params::jdbc_ssl_properties,
   $database_validate      = $puppetdb::params::database_validate,
   $database_embedded_path = $puppetdb::params::database_embedded_path,
@@ -89,7 +90,7 @@
       value   => $database_username,
     }
 
-    if $database_password != undef {
+    if $database_password != undef and $manage_db_password {
       ini_setting {'puppetdb_psdatabase_password':
         setting => 'password',
         value   => $database_password,

manifests/server/read_database.pp

@@ -6,6 +6,7 @@
   $database_username      = $puppetdb::params::read_database_username,
   $database_password      = $puppetdb::params::read_database_password,
   $database_name          = $puppetdb::params::read_database_name,
+  $manage_db_password     = $puppetdb::params::manage_read_db_password,
   $jdbc_ssl_properties    = $puppetdb::params::read_database_jdbc_ssl_properties,
   $database_validate      = $puppetdb::params::read_database_validate,
   $log_slow_statements    = $puppetdb::params::read_log_slow_statements,
@@ -79,7 +80,7 @@
         value   => $database_username,
       }
 
-      if $database_password != undef {
+      if $database_password != undef and $manage_db_password {
         ini_setting { 'puppetdb_read_database_password':
           setting => 'password',
           value   => $database_password,

spec/unit/classes/init_spec.rb

@@ -48,6 +48,24 @@ class { 'postgresql::server':
           it { is_expected.not_to contain_postgresql__server__db('puppetdb') }
         end
       end
+
+      context 'when not managing the database password' do
+        let(:params) do
+          {
+            'manage_db_password' => false,
+            'manage_read_db_password' => false,
+            'read_database_host' => '10.0.0.1', # Make sure the read_database class is enforced.
+          }
+        end
+
+        describe 'ini_setting entries for the password will not exist' do
+          it { is_expected.to contain_class('puppetdb::server').with('manage_db_password' => false) }
+          it { is_expected.to contain_class('puppetdb::server').with('manage_read_db_password' => false) }
+
+          it { is_expected.not_to contain_ini__setting('puppetdb_psdatabase_password') }
+          it { is_expected.not_to contain_ini__setting('puppetdb_read_database_password') }
+        end
+      end
     end
   end
 

spec/unit/classes/server_spec.rb

@@ -151,6 +151,24 @@
           it { is_expected.not_to contain_systemd__unit_file('puppetdb-dlo-cleanup.timer') }
         end
       end
+
+      context 'when not managing the database password' do
+        let(:params) do
+          {
+            'manage_db_password' => false,
+            'manage_read_db_password' => false,
+            'read_database_host' => '10.0.0.1', # Make sure the read_database class is enforced.
+          }
+        end
+
+        describe 'ini_setting entries for the password will not exist' do
+          it { is_expected.to contain_class('puppetdb::server::database').with('manage_db_password' => false) }
+          it { is_expected.to contain_class('puppetdb::server::read_database').with('manage_db_password' => false) }
+
+          it { is_expected.not_to contain_ini__setting('puppetdb_psdatabase_password') }
+          it { is_expected.not_to contain_ini__setting('puppetdb_read_database_password') }
+        end
+      end
     end
   end
 end